Click here to load reader


  • View

  • Download

Embed Size (px)

Text of Intel386TM DX MICROPROCESSOR 32-BIT CHMOS MICROPROCESSOR … ·  · 2013-10-01Intel386TM DX...

  • *Other brands and names are the property of their respective owners.Information in this document is provided in connection with Intel products. Intel assumes no liability whatsoever, including infringement of any patent orcopyright, for sale and use of Intel products except as provided in Intels Terms and Conditions of Sale for such products. Intel retains the right to makechanges to these specifications at any time, without notice. Microcomputer Products may have minor variations to this specification known as errata.

    December 1995COPYRIGHT INTEL CORPORATION, 1995 Order Number: 231630-011


    WITH INTEGRATED MEMORY MANAGEMENTY Flexible 32-Bit Microprocessor

    8, 16, 32-Bit Data Types 8 General Purpose 32-Bit Registers

    Y Very Large Address Space 4 Gigabyte Physical 64 Terabyte Virtual 4 Gigabyte Maximum Segment Size

    Y Integrated Memory Management Unit Virtual Memory Support Optional On-Chip Paging 4 Levels of Protection Fully Compatible with 80286

    Y Object Code Compatible with All 8086Family Microprocessors

    Y Virtual 8086 Mode Allows Running of8086 Software in a Protected andPaged System

    Y Hardware Debugging Support

    Y Optimized for System Performance Pipelined Instruction Execution On-Chip Address Translation Caches 20, 25 and 33 MHz Clock 40, 50 and 66 Megabytes/Sec Bus


    Y Numerics Support via Intel387TM DXMath Coprocessor

    Y Complete System DevelopmentSupport Software: C, PL/M, Assembler

    System Generation Tools Debuggers: PSCOPE, ICETM-386

    Y High Speed CHMOS IV Technology

    Y 132 Pin Grid Array Package

    Y 132 Pin Plastic Quad Flat Package(See Packaging Specification, Order 231369)

    The Intel386 DX Microprocessor is an entry-level 32-bit microprocessor designed for single-user applicationsand operating systems such as MS-DOS and Windows. The 32-bit registers and data paths support 32-bitaddresses and data types. The processor addresses up to four gigabytes of physical memory and 64 terabytes(2**46) of virtual memory. The integrated memory management and protection architecture includes addresstranslation registers, multitasking hardware and a protection mechanism to support operating systems. Instruc-tion pipelining, on-chip address translation, ensure short average instruction execution times and maximumsystem throughput.

    The Intel386 DX CPU offers new testability and debugging features. Testability features include a self-test anddirect access to the page translation cache. Four new breakpoint registers provide breakpoint traps on codeexecution or data accesses, for powerful debugging of even ROM-based systems.

    Object-code compatibility with all 8086 family members (8086, 8088, 80186, 80188, 80286) means theIntel386 DX offers immediate access to the worlds largest microprocessor software base.


    Intel386TM DX Pipelined 32-Bit Microarchitecture

    Intel386TM DX and Intel387TM DX are Trademarks of Intel Corporation.MS-DOS and Windows are Trademarks of MICROSOFT Corporation.

    wqdwqd s wdwd




    1. PIN ASSIGNMENT 51.1 Pin Description Table 6

    2. BASE ARCHITECTURE 82.1 Introduction 82.2 Register Overview 82.3 Register Descriptions 92.4 Instruction Set 152.5 Addressing Modes 182.6 Data Types 202.7 Memory Organization 222.8 I/O Space 232.9 Interrupts 242.10 Reset and Initialization 272.11 Testability 282.12 Debugging Support 28

    3. REAL MODE ARCHITECTURE 323.1 Real Mode Introduction 323.2 Memory Addressing 333.3 Reserved Locations 343.4 Interrupts 343.5 Shutdown and Halt 34

    4. PROTECTED MODE ARCHITECTURE 344.1 Introduction 344.2 Addressing Mechanism 354.3 Segmentation 364.4 Protection 464.5 Paging 524.6 Virtual 8086 Environment 56

    5. FUNCTIONAL DATA 615.1 Introduction 615.2 Signal Description 61

    5.2.1 Introduction 615.2.2 Clock (CLK2) 625.2.3 Data Bus (D0 through D31) 625.2.4 Address Bus (BEO through BE3, A2 through A31) 625.2.5 Bus Cycle Definition Signals (W/R, D/C, M/IO, LOCK) 635.2.6 Bus Control Signals (ADS, READY, NA, BS16) 645.2.7 Bus Arbitration Signals (HOLD, HLDA) 655.2.8 Coprocessor Interface Signals (PEREQ, BUSY, ERROR) 655.2.9 Interrupt Signals (INTR, NMI, RESET) 665.2.10 Signal Summary 67



    5. FUNCTIONAL DATA (Continued)5.3. Bus Transfer Mechanism 67

    5.3.1 Introduction 675.3.2 Memory and I/O Spaces 685.3.3 Memory and I/O Organization 695.3.4 Dynamic Data Bus Sizing 695.3.5 Interfacing with 32- and 16-bit Memories 705.3.6 Operand Alignment 71

    5.4 Bus Functional Description 715.4.1 Introduction 715.4.2 Address Pipelining 745.4.3 Read and Write Cycles 765.4.4 Interrupt Acknowledge (INTA) Cycles 875.4.5 Halt Indication Cycle 885.4.6 Shutdown Indication Cycle 89

    5.5 Other Functional Descriptions 905.5.1 Entering and Exiting Hold Acknowledge 905.5.2 Reset during Hold Acknowledge 905.5.3 Bus Activity During and Following Reset 90

    5.6 Self-test Signature 925.7 Component and Revision Identifiers 925.8 Coprocessor Interface 94

    5.8.1 Software Testing for Coprocessor Presence 94

    6. INSTRUCTION SET 956.1 Instruction Encoding and Clock Count Summary 956.2 Instruction Encoding Details 110


    8. MECHANICAL DATA 1198.1 Introduction 1198.2 Package Dimensions and Mounting 1198.3 Package Thermal Specification 122

    9. ELECTRICAL DATA 1239.1 Introduction 1239.2 Power and Grounding 1239.3 Maximum Ratings 1249.4 D.C. Specifications 1249.5 A.C. Specifications 125


    NOTE:This is revision 011; This supercedes all previous revisions.




    The Intel386 DX pinout as viewed from the top sideof the component is shown by Figure 1-1. Its pinoutas viewed from the Pin side of the component isFigure 1-2.

    VCC and GND connections must be made to multi-ple VCC and VSS (GND) pins. Each VCC and VSSmust be connected to the appropriate voltage level.The circuit board should include VCC and GNDplanes for power distribution and all VCC and VSSpins must be connected to the appropriate plane.

    NOTE:Pins identified as N.C. should remain completelyunconnected.


    Figure 1-1. Intel386TM DX PGA

    PinoutView from Top Side


    Figure 1-2. Intel386TM DX PGA

    PinoutView from Pin Side

    Table 1-1. Intel386TM DX PGA PinoutFunctional Grouping

    Signal/Pin Signal/Pin Signal/Pin Signal/Pin Signal/Pin Signal/Pin

    A2 C4 A24 L2 D6 L14 D28 M6 VCC C12 VSS F2

    A3 A3 A25 K3 D7 K12 D29 P4 D12 F3

    A4 B3 A26 M1 D8 L13 D30 P3 G2 F14

    A5 B2 A27 N1 D9 N14 D31 M5 G3 J2

    A6 C3 A28 L3 D10 M12 D/C A11 G12 J3A7 C2 A29 M2 D11 N13 ERROR A8 G14 J12A8 C1 A30 P1 D12 N12 HLDA M14 L12 J13

    A9 D3 A31 N2 D13 P13 HOLD D14 M3 M4

    A10 D2 ADS E14 D14 P12 INTR B7 M7 M8A11 D1 BE0 E12 D15 M11 LOCK C10 M13 M10A12 E3 BE1 C13 D16 N11 M/IO A12 N4 N3A13 E2 BE2 B13 D17 N10 NA D13 N7 P6A14 E1 BE3 A13 D18 P11 NMI B8 P2 P14A15 F1 BS16 C14 D19 P10 PEREQ C8 P8 W/R B10A16 G1 BUSY B9 D20 M9 READY G13 VSS A2 N.C. A4A17 H1 CLK2 F12 D21 N9 RESET C9 A6 B4

    A18 H2 D0 H12 D22 P9 VCC A1 A9 B6

    A19 H3 D1 H13 D23 N8 A5 B1 B12

    A20 J1 D2 H14 D24 P7 A7 B5 C6

    A21 K1 D3 J14 D25 N6 A10 B11 C7

    A22 K2 D4 K14 D26 P5 A14 B14 E13

    A23 L1 D5 K13 D27 N5 C5 C11 F13




    The following table lists a brief description of each pin on the Intel386 DX. The following definitions are used inthese descriptions:

    The named signal is active LOW.I Input signal.

    O Output signal.

    I/O Input and Output signal.

    No electrical connection.

    For a more complete description refer to Section 5.2 Signal Description.

    Symbol Type Name and Function

    CLK2 I CLK2 provides the fundamental timing for the Intel386 DX.

    D31D0 I/O DATA BUS inputs data during memory, I/O and interrupt acknowledge

    read cycles and outputs data during memory and I/O write cycles.

    A31A2 O ADDRESS BUS outputs physical memory or port I/O addresses.

    BE0BE3 O BYTE ENABLES indicate which data bytes of the data bus take part ina bus cycle.

    W/R O WRITE/READ is a bus cycle definition pin that distinguishes writecycles from read cycles.

    D/C O DATA/CONTROL is a bus cycle definition pin that distinguishes datacycles, either memory or I/O, from control cycles which are: interrupt

    acknowledge, halt, and instruction fetching.

    M/IO O MEMORY I/O is a bus cycle definition pin that distinguishes memorycycles from input/output cycles.

    LOCK O BUS LOCK is a bus cycle definition pin that indicates that othersystem bus masters are denied access to the system bus while it is


    ADS O ADDRESS STATUS indicates that a valid bus cycle definition andaddress (W/R, D/C, M/IO, BE0, BE1, BE2, BE3 andA31A2) are being driven at the Intel386 DX pins.

    NA I NEXT ADDRESS is used to request address pipelining.

    READY I BUS READY terminates the bus cycle.

    BS16 I BUS SIZE 16 input allows direct connection of 32-bit and 16-bit databuses.

    HOLD I BUS HOLD REQUEST input allows another bus master to request

    control of the local bus.



    1.1 PIN DESCRIPTION TABLE (Continued)

    Symbol Type Name and Function

    HLDA O BUS HOLD ACKNOWLEDGE output indicates that the Intel386 DX

    has surrendered control of its local bus to another bus master.

    BUSY I BUSY signals a busy condition from a processor extension.

    ERROR I ERROR signals an error condition from a processor extension.

    PEREQ I PROCESSOR EXTENSION REQUEST indicates that the processor

    extension has data to be transferred by the Intel386 DX.

    INTR I INTERRUPT REQUEST is a maskable input that signals the Intel386

    DX to suspend execution of the current program and execute an

    interrupt acknowledge function.

    NMI I NON-MASKABLE INTERRUPT REQUEST is a non-maskable input

    that signals the Intel386 DX to suspend execution of the current

    program and execute an interrupt acknowledge function.

    RESET I RESET suspends any operation in progress and places the Intel386

    DX in a known reset state. See Interrupt Signals for additional


    N/C NO CONNECT should always remain unconnected. Connection of a

    N/C pin may cause the processor to malfunction or be incompatible

    with future steppings of the Intel386 DX.

    VCC I SYSTEM POWER provides the a5V nominal D.C. supply input.

    VSS I SYSTEM GROUND provides 0V connection from which all inputs and

    outputs are measured.





    The Intel386 DX consists of a central processingunit, a memory management unit and a bus inter-face.

    The central processing unit consists of the execu-tion unit and instruction unit. The execution unit con-tains the eight 32-bit general purpose registerswhich are used for both address calculation, dataoperations and a 64-bit barrel shifter used to speedshift, rotate, multiply, and divide operations. Themultiply and divide logic uses a 1-bit per cycle algo-rithm. The multiply algorithm stops the iterationwhen the most significant bits of the multiplier are allzero. This allows typical 32-bit multiplies to be exe-cuted in under one microsecond. The instruction unitdecodes the instruction opcodes and stores them inthe decoded instruction queue for immediate use bythe execution unit.

    The memory management unit (MMU) consists of asegmentation unit and a paging unit. Segmentationallows the managing of the logical address space byproviding an extra addressing component, one thatallows easy code and data relocatability, and effi-cient sharing. The paging mechanism operates be-neath and is transparent to the segmentation pro-cess, to allow management of the physical addressspace. Each segment is divided into one or more 4Kbyte pages. To implement a virtual memory system,the Intel386 DX supports full restartability for allpage and segment faults.

    Memory is organized into one or more variablelength segments, each up to four gigabytes in size. Agiven region of the linear address space, a segment,can have attributes associated with it. These attri-butes include its location, size, type (i.e. stack, codeor data), and protection characteristics. Each taskon an Intel386 DX can have a maximum of 16,381segments of up to four gigabytes each, thus provid-ing 64 terabytes (trillion bytes) of virtual memory toeach task.

    The segmentation unit provides four-levels of pro-tection for isolating and protecting applications andthe operating system from each other. The hardwareenforced protection allows the design of systemswith a high degree of integrity.

    The Intel386 DX has two modes of operation: RealAddress Mode (Real Mode), and Protected VirtualAddress Mode (Protected Mode). In Real Mode theIntel386 DX operates as a very fast 8086, but with

    32-bit extensions if desired. Real Mode is requiredprimarily to setup the processor for Protected Modeoperation. Protected Mode provides access to thesophisticated memory management, paging andprivilege capabilities of the processor.

    Within Protected Mode, software can perform a taskswitch to enter into tasks designated as Virtual 8086Mode tasks. Each such task behaves with 8086 se-mantics, thus allowing 8086 software (an applicationprogram, or an entire operating system) to execute.The Virtual 8086 tasks can be isolated and protect-ed from one another and the host Intel386 DX oper-ating system, by the use of paging, and the I/O Per-mission Bitmap.

    Finally, to facilitate high performance system hard-ware designs, the Intel386 DX bus interface offersaddress pipelining, dynamic data bus sizing, and di-rect Byte Enable signals for each byte of the databus. These hardware features are described fully be-ginning in Section 5.


    The Intel386 DX has 32 register resources in thefollowing categories:

    # General Purpose Registers# Segment Registers# Instruction Pointer and Flags# Control Registers# System Address Registers# Debug Registers# Test Registers.

    The registers are a superset of the 8086, 80186 and80286 registers, so all 16-bit 8086, 80186 and80286 registers are contained within the 32-bit In-tel386 DX.

    Figure 2-1 shows all of Intel386 DX base architec-ture registers, which include the general addressand data registers, the instruction pointer, and theflags register. The contents of these registers aretask-specific, so these registers are automaticallyloaded with a new context upon a task switch opera-tion.

    The base architecture also includes six directly ac-cessible segments, each up to 4 Gbytes in size. Thesegments are indicated by the selector valuesplaced in Intel386 DX segment registers of Figure2-1. Various selector values can be loaded as a pro-gram executes, if desired.




    AX EAX

    BX EBX

    CX ECX

    DX EDX

    SI ESI

    DI EDI

    BP EBP

    SP ESP








    IP EIP


    Figure 2-1. Intel386TM DX Base

    Architecture Registers

    The selectors are also task-specific, so the segmentregisters are automatically loaded with new contextupon a task switch operation.

    The other types of registers, Control, System Ad-dress, Debug, and Test, are primarily used by sys-tem software.


    2.3.1 General Purpose Registers

    General Purpose Registers: The eight general pur-pose registers of 32 bits hold data or address quanti-ties. The general registers, Figure 2-2, support dataoperands of 1, 8, 16, 32 and 64 bits, and bit fields of1 to 32 bits. They support address operands of 16and 32 bits. The 32-bit registers are named EAX,EBX, ECX, EDX, ESI, EDI, EBP, and ESP.

    The least significant 16 bits of the registers can beaccessed separately. This is done by using the 16-bit names of the registers AX, BX, CX, DX, SI, DI,

    BP, and SP. When accessed as a 16-bit operand,the upper 16 bits of the register are neither used norchanged.

    Finally 8-bit operations can individually access thelowest byte (bits 07) and the higher byte (bits 815) of general purpose registers AX, BX, CX and DX.The lowest bytes are named AL, BL, CL and DL,respectively. The higher bytes are named AH, BH,CH and DH, respectively. The individual byte acces-sibility offers additional flexibility for data operations,but is not used for effective address calculation.

    31 16 15 8 7 0





    SI ESI

    DI EDI

    BP EBP

    SP ESP

    31 16 15 0


    X YIP

    Figure 2-2. General Registers

    and Instruction Pointer

    2.3.2 Instruction Pointer

    The instruction pointer, Figure 2-2, is a 32-bit regis-ter named EIP. EIP holds the offset of the next in-struction to be executed. The offset is always rela-tive to the base of the code segment (CS). The low-er 16 bits (bits 015) of EIP contain the 16-bit in-struction pointer named IP, which is used by 16-bitaddressing.

    2.3.3 Flags Register

    The Flags Register is a 32-bit register namedEFLAGS. The defined bits and bit fields withinEFLAGS, shown in Figure 2-3, control certain opera-tions and indicate status of the Intel386 DX. Thelower 16 bits (bit 015) of EFLAGS contain the16-bit flag register named FLAGS, which is mostuseful when executing 8086 and 80286 code.


  • 0



    NOTE:0 indicates Intel reserved: do not define; see section 2.3.10.

    Figure 2-3. Flags Register

    VM (Virtual 8086 Mode, bit 17)

    The VM bit provides Virtual 8086 Mode withinProtected Mode. If set while the Intel386 DXis in Protected Mode, the Intel386 DX willswitch to Virtual 8086 operation, handlingsegment loads as the 8086 does, but gener-ating exception 13 faults on privileged op-codes. The VM bit can be set only in Protect-ed Mode, by the IRET instruction (if currentprivilege level e 0) and by task switches atany privilege level. The VM bit is unaffectedby POPF. PUSHF always pushes a 0 in thisbit, even if executing in virtual 8086 Mode.The EFLAGS image pushed during interruptprocessing or saved during task switches willcontain a 1 in this bit if the interrupted codewas executing as a Virtual 8086 Task.

    RF (Resume Flag, bit 16)

    The RF flag is used in conjunction with thedebug register breakpoints. It is checked atinstruction boundaries before breakpoint pro-cessing. When RF is set, it causes any debugfault to be ignored on the next instruction. RFis then automatically reset at the successfulcompletion of every instruction (no faults aresignalled) except the IRET instruction, thePOPF instruction, (and JMP, CALL, and INTinstructions causing a task switch). These in-structions set RF to the value specified by thememory image. For example, at the end ofthe breakpoint service routine, the IRET

    instruction can pop an EFLAG image havingthe RF bit set and resume the programs exe-cution at the breakpoint address without gen-erating another breakpoint fault on the samelocation.

    NT (Nested Task, bit 14)

    This flag applies to Protected Mode. NT is setto indicate that the execution of this task isnested within another task. If set, it indicatesthat the current nested tasks Task StateSegment (TSS) has a valid back link to theprevious tasks TSS. This bit is set or reset bycontrol transfers to other tasks. The value ofNT in EFLAGS is tested by the IRET instruc-tion to determine whether to do an inter-taskreturn or an intra-task return. A POPF or anIRET instruction will affect the setting of thisbit according to the image popped, at anyprivilege level.

    IOPL (Input/Output Privilege Level, bits 12-13)

    This two-bit field applies to Protected Mode.IOPL indicates the numerically maximum CPL(current privilege level) value permitted to ex-ecute I/O instructions without generating anexception 13 fault or consulting the I/O Per-mission Bitmap. It also indicates the maxi-mum CPL value allowing alteration of the IF(INTR Enable Flag) bit when new values arepopped into the EFLAG register. POPF andIRET instruction can alter the IOPL field whenexecuted at CPL e 0. Task switches can al-ways alter the IOPL field, when the new flagimage is loaded from the incoming tasksTSS.



    OF (Overflow Flag, bit 11)

    OF is set if the operation resulted in a signedoverflow. Signed overflow occurs when theoperation resulted in carry/borrow into thesign bit (high-order bit) of the result but didnot result in a carry/borrow out of the high-order bit, or vice-versa. For 8/16/32 bit oper-ations, OF is set according to overflow at bit7/15/31, respectively.

    DF (Direction Flag, bit 10)

    DF defines whether ESI and/or EDI registerspostdecrement or postincrement during thestring instructions. Postincrement occurs ifDF is reset. Postdecrement occurs if DF isset.

    IF (INTR Enable Flag, bit 9)

    The IF flag, when set, allows recognition ofexternal interrupts signalled on the INTR pin.When IF is reset, external interrupts signalledon the INTR are not recognized. IOPL indi-cates the maximum CPL value allowing alter-ation of the IF bit when new values arepopped into EFLAGS or FLAGS.

    TF (Trap Enable Flag, bit 8)

    TF controls the generation of exception 1trap when single-stepping through code.When TF is set, the Intel386 DX generates anexception 1 trap after the next instruction isexecuted. When TF is reset, exception 1traps occur only as a function of the break-point addresses loaded into debug registersDR0DR3.

    SF (Sign Flag, bit 7)

    SF is set if the high-order bit of the result isset, it is reset otherwise. For 8-, 16-, 32-bitoperations, SF reflects the state of bit 7, 15,31 respectively.

    ZF (Zero Flag, bit 6)

    ZF is set if all bits of the result are 0. Other-wise it is reset.

    AF (Auxiliary Carry Flag, bit 4)

    The Auxiliary Flag is used to simplify the addi-tion and subtraction of packed BCD quanti-ties. AF is set if the operation resulted in acarry out of bit 3 (addition) or a borrow into bit3 (subtraction). Otherwise AF is reset. AF isaffected by carry out of, or borrow into bit 3only, regardless of overall operand length: 8,16 or 32 bits.

    PF (Parity Flags, bit 2)

    PF is set if the low-order eight bits of the op-eration contains an even number of 1s(even parity). PF is reset if the low-order eightbits have odd parity. PF is a function of onlythe low-order eight bits, regardless of oper-and size.

    CF (Carry Flag, bit 0)

    CF is set if the operation resulted in a carryout of (addition), or a borrow into (subtraction)the high-order bit. Otherwise CF is reset. For8-, 16- or 32-bit operations, CF is set accord-ing to carry/borrow at bit 7, 15 or 31, respec-tively.

    Note in these descriptions, set means set to 1,and reset means reset to 0.

    2.3.4 Segment Registers

    Six 16-bit segment registers hold segment selectorvalues identifying the currently addressable memorysegments. Segment registers are shown in Figure 2-4. In Protected Mode, each segment may range insize from one byte up to the entire linear and physi-




    15 0 Physical Base Address Segment Limit Attributes from Descriptor

    Selector CS

    Selector SS

    Selector DS

    Selector ES

    Selector FS

    Selector GS

    Figure 2-4. Intel386TM DX Segment Registers, and Associated Descriptor Registers



    cal space of the machine, 4 Gbytes (232 bytes). If amaximum sized segment is used (limit eFFFFFFFFH) it should be Dword aligned (i.e., theleast two significant bits of the segment base shouldbe zero). This will avoid a segment limit violation (ex-ception 13) caused by the wrap around. In Real Ad-dress Mode, the maximum segment size is fixed at64 Kbytes (216 bytes).

    The six segments addressable at any given momentare defined by the segment registers CS, SS, DS,ES, FS and GS. The selector in CS indicates thecurrent code segment; the selector in SS indicatesthe current stack segment; the selectors in DS, ES,FS and GS indicate the current data segments.

    2.3.5 Segment Descriptor Registers

    The segment descriptor registers are not program-mer visible, yet it is very useful to understand theircontent. Inside the Intel386 DX, a descriptor register(programmer invisible) is associated with each pro-grammer-visible segment register, as shown by Fig-ure 2-4. Each descriptor register holds a 32-bit seg-ment base address, a 32-bit segment limit, and theother necessary segment attributes.

    When a selector value is loaded into a segment reg-ister, the associated descriptor register is automati-cally updated with the correct information. In RealAddress Mode, only the base address is updateddirectly (by shifting the selector value four bits to theleft), since the segment maximum limit and attributesare fixed in Real Mode. In Protected Mode, the baseaddress, the limit, and the attributes are all updatedper the contents of the segment descriptor indexedby the selector.

    Whenever a memory reference occurs, the segmentdescriptor register associated with the segment be-ing used is automatically involved with the memoryreference. The 32-bit segment base address be-comes a component of the linear address calcula-

    tion, the 32-bit limit is used for the limit-check opera-tion, and the attributes are checked against the typeof memory reference requested.

    2.3.6 Control Registers

    The Intel386 DX has three control registers of 32bits, CR0, CR2 and CR3, to hold machine state of aglobal nature (not specific to an individual task).These registers, along with System Address Regis-ters described in the next section, hold machinestate that affects all tasks in the system. To accessthe Control Registers, load and store instructionsare defined.

    CR0: Machine Control Register (includes 80286Machine Status Word)

    CR0, shown in Figure 2-5, contains 6 defined bits forcontrol and status purposes. The low-order 16 bitsof CR0 are also known as the Machine Status Word,MSW, for compatibility with 80286 Protected Mode.LMSW and SMSW instructions are taken as specialaliases of the load and store CR0 operations, whereonly the low-order 16 bits of CR0 are involved. Forcompatibility with 80286 operating systems the In-tel386 DX LMSW instructions work in an identicalfashion to the LMSW instruction on the 80286. (i.e. Itonly operates on the low-order 16-bits of CR0 and itignores the new bits in CR0.) New Intel386 DX oper-ating systems should use the MOV CR0, Reg in-struction.

    The defined CR0 bits are described below.

    PG (Paging Enable, bit 31)

    the PG bit is set to enable the on-chip pagingunit. It is reset to disable the on-chip pagingunit.

    R (reserved, bit 4)

    This bit is reserved by Intel. When loading CR0care should be taken to not alter the value ofthis bit.

    31 24 23 16 15 8 7 0

    P0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 R

    T E M PCR0

    G S M P E

    X YMSW

    NOTE: 0 indicates Intel reserved: Do not define; SEE SECTION 2.3.10

    Figure 2-5. Control Register 0



    TS (Task Switched, bit 3)

    TS is automatically set whenever a task switchoperation is performed. If TS is set, a coproces-sor ESCape opcode will cause a CoprocessorNot Available trap (exception 7). The trap han-dler typically saves the Intel387 DX coproces-sor context belonging to a previous task, loadsthe Intel387 DX coprocessor state belonging tothe current task, and clears the TS bit beforereturning to the faulting coprocessor opcode.

    EM (Emulate Coprocessor, bit 2)

    The EMulate coprocessor bit is set to cause allcoprocessor opcodes to generate a Coproces-sor Not Available fault (exception 7). It is resetto allow coprocessor opcodes to be executedon an actual Intel387 DX coprocessor (this isthe default case after reset). Note that theWAIT opcode is not affected by the EM bit set-ting.

    MP (Monitor Coprocessor, bit 1)

    The MP bit is used in conjunction with the TSbit to determine if the WAIT opcode will gener-ate a Coprocessor Not Available fault (excep-tion 7) when TS e 1. When both MP e 1 andTS e 1, the WAIT opcode generates a trap.Otherwise, the WAIT opcode does not gener-ate a trap. Note that TS is automatically setwhenever a task switch operation is performed.

    PE (Protection Enable, bit 0)

    The PE bit is set to enable the Protected Mode.If PE is reset, the processor operates again inReal Mode. PE may be set by loading MSW orCR0. PE can be reset only by a load into CR0.Resetting the PE bit is typically part of a longerinstruction sequence needed for proper tran-sition from Protected Mode to Real Mode. Notethat for strict 80286 compatibility, PE cannot bereset by the LMSW instruction.

    CR1: reserved

    CR1 is reserved for use in future Intel processors.

    CR2: Page Fault Linear Address

    CR2, shown in Figure 2-6, holds the 32-bit linear ad-dress that caused the last page fault detected. The

    error code pushed onto the page fault handlersstack when it is invoked provides additional statusinformation on this page fault.

    CR3: Page Directory Base Address

    CR3, shown in Figure 2-6, contains the physicalbase address of the page directory table. The In-tel386 DX page directory table is always page-aligned (4 Kbyte-aligned). Therefore the lowesttwelve bits of CR3 are ignored when written andthey store as undefined.

    A task switch through a TSS which changes thevalue in CR3, or an explicit load into CR3 with anyvalue, will invalidate all cached page table entries inthe paging unit cache. Note that if the value in CR3does not change during the task switch, the cachedpage table entries are not flushed.

    2.3.7 System Address Registers

    Four special registers are defined to reference thetables or segments supported by the 80286 CPUand Intel386 DX protection model. These tables orsegments are:

    GDT (Global Descriptor Table),

    IDT (Interrupt Descriptor Table),

    LDT (Local Descriptor Table),

    TSS (Task State Segment).

    The addresses of these tables and segments arestored in special registers, the System Address andSystem Segment Registers illustrated in Figure 2-7.These registers are named GDTR, IDTR, LDTR andTR, respectively. Section 4 Protected Mode Archi-tecture describes the use of these registers.

    GDTR and IDTR

    These registers hold the 32-bit linear base addressand 16-bit limit of the GDT and IDT, respectively.

    The GDT and IDT segments, since they are global toall tasks in the system, are defined by 32-bit linearaddresses (subject to page translation if paging isenabled) and 16-bit limit values.

    31 24 23 16 15 8 7 0


    PAGE DIRECTORY BASE REGISTER 0 0 0 0 0 0 0 0 0 0 0 0 CR3

    NOTE: 0 indicates Intel reserved: Do not define; SEE SECTION 2.3.10

    Figure 2-6. Control Registers 2 and 3











    Figure 2-7. System Address and System Segment Registers

    LDTR and TR

    These registers hold the 16-bit selector for the LDTdescriptor and the TSS descriptor, respectively.

    The LDT and TSS segments, since they are task-specific segments, are defined by selector valuesstored in the system segment registers. Note that asegment descriptor register (programmer-invisible)is associated with each system segment register.

    2.3.8 Debug and Test Registers

    Debug Registers: The six programmer accessibledebug registers provide on-chip support for debug-ging. Debug Registers DR03 specify the four linearbreakpoints. The Debug Control Register DR7 isused to set the breakpoints and the Debug StatusRegister DR6, displays the current state of thebreakpoints. The use of the debug registers is de-scribed in section 2.12 Debugging support.






    Intel reserved. Do not define. DR4

    Intel reserved. Do not define. DR5






    Figure 2-8. Debug and Test Registers

    Test Registers: Two registers are used to controlthe testing of the RAM/CAM (Content AddressableMemories) in the Translation Lookaside Buffer por-tion of the Intel386 DX. TR6 is the command testregister, and TR7 is the data register which containsthe data of the Translation Lookaside buffer test.Their use is discussed in section 2.11 Testability.

    Figure 2-8 shows the Debug and Test registers.

    2.3.9 Register Accessibility

    There are a few differences regarding the accessibil-ity of the registers in Real and Protected Mode. Ta-ble 2-1 summarizes these differences. See Section4 Protected Mode Architecture for further details.

    2.3.10 Compatibility


    In the preceding register descriptions, note cer-tain Intel386 DX register bits are Intel reserved.When reserved bits are called out, treat them asfully undefined. This is essential for your soft-ware compatibility with future processors! Fol-low the guidelines below:

    1) Do not depend on the states of any unde-fined bits when testing the values of definedregister bits. Mask them out when testing.

    2) Do not depend on the states of any unde-fined bits when storing them to memory oranother register.

    3) Do not depend on the ability to retain infor-mation written into any undefined bits.

    4) When loading registers always load the unde-fined bits as zeros.



    Table 2-1. Register Usage

    Use in Use in Use in

    RegisterReal Mode Protected Mode Virtual 8086 Mode

    Load Store Load Store Load Store

    General Registers Yes Yes Yes Yes Yes Yes

    Segment Registers Yes Yes Yes Yes Yes Yes

    Flag Register Yes Yes Yes Yes IOPL* IOPL*

    Control Registers Yes Yes PL e 0 PL e 0 No Yes

    GDTR Yes Yes PL e 0 Yes No Yes

    IDTR Yes Yes PL e 0 Yes No Yes

    LDTR No No PL e 0 Yes No No

    TR No No PL e 0 Yes No No

    Debug Control Yes Yes PL e 0 PL e 0 No No

    Test Registers Yes Yes PL e 0 PL e 0 No No

    NOTES:PL e 0: The registers can be accessed only when the current privilege level is zero.*IOPL: The PUSHF and POPF instructions are made I/O Privilege Level sensitive in Virtual 8086 Mode.

    5) However, registers which have been previ-ously stored may be reloaded without mask-ing.

    Depending upon the values of undefined regis-ter bits will make your software dependent uponthe unspecified Intel386 DX handling of thesebits. Depending on undefined values risks mak-ing your software incompatible with future proc-essors that define usages for the Intel386 DX-undefined bits. AVOID ANY SOFTWARE DEPEN-DENCE UPON THE STATE OF UNDEFINED In-tel386 DX REGISTER BITS.


    2.4.1 Instruction Set Overview

    The instruction set is divided into nine categories ofoperations:

    Data Transfer



    String Manipulation

    Bit Manipulation

    Control Transfer

    High Level Language Support

    Operating System Support

    Processor Control

    These Intel386 DX instructions are listed in Table2-2.

    All Intel386 DX instructions operate on either 0, 1, 2,or 3 operands; where an operand resides in a regis-ter, in the instruction itself, or in memory. Most zerooperand instructions (e.g. CLI, STI) take only onebyte. One operand instructions generally are twobytes long. The average instruction is 3.2 bytes long.Since the Intel386 DX has a 16-byte instructionqueue, an average of 5 instructions will be pre-fetched. The use of two operands permits the follow-ing types of common instructions:

    Register to Register

    Memory to Register

    Immediate to Register

    Register to Memory

    Immediate to Memory.

    The operands can be either 8, 16, or 32 bits long. Asa general rule, when executing code written for theIntel386 DX (32-bit code), operands are 8 or 32 bits;when executing existing 80286 or 8086 code (16-bitcode), operands are 8 or 16 bits. Prefixes can beadded to all instructions which override the defaultlength of the operands, (i.e. use 32-bit operands for16-bit code, or 16-bit operands for 32-bit code).

    For a more elaborate description of the instructionset, refer to the Intel386 DX Programmers Refer-ence Manual.



    2.4.2 Intel386TM DX Instructions

    Table 2-2a. Data Transfer


    MOV Move operand

    PUSH Push operand onto stack

    POP Pop operand off stack

    PUSHA Push all registers on stack

    POPA Pop all registers off stack

    XCHG Exchange Operand, Register

    XLAT Translate


    MOVZX Move byte or Word, Dword, with zeroextension

    MOVSX Move byte or Word, Dword, signextended

    CBW Convert byte to Word, or Word to Dword

    CWD Convert Word to DWORD

    CWDE Convert Word to DWORD extended

    CDQ Convert DWORD to QWORD


    IN Input operand from I/O space

    OUT Output operand to I/O space


    LEA Load effective address

    LDS Load pointer into D segment register

    LES Load pointer into E segment register

    LFS Load pointer into F segment register

    LGS Load pointer into G segment register

    LSS Load pointer into S (Stack) segmentregister


    LAHF Load A register from Flags

    SAHF Store A register in Flags

    PUSHF Push flags onto stack

    POPF Pop flags off stack

    PUSHFD Push EFlags onto stack

    POPFD Pop EFlags off stack

    CLC Clear Carry Flag

    CLD Clear Direction Flag

    CMC Complement Carry Flag

    STC Set Carry Flag

    STD Set Direction Flag

    Table 2-2b. Arithmetic Instructions


    ADD Add operands

    ADC Add with carry

    INC Increment operand by 1

    AAA ASCII adjust for addition

    DAA Decimal adjust for addition


    SUB Subtract operands

    SBB Subtract with borrow

    DEC Decrement operand by 1

    NEG Negate operand

    CMP Compare operands

    DAS Decimal adjust for subtraction

    AAS ASCII Adjust for subtraction


    MUL Multiply Double/Single Precision

    IMUL Integer multiply

    AAM ASCII adjust after multiply


    DIV Divide unsigned

    IDIV Integer Divide

    AAD ASCII adjust before division

    Table 2-2c. String Instructions

    MOVS Move byte or Word, Dword string

    INS Input string from I/O space

    OUTS Output string to I/O space

    CMPS Compare byte or Word, Dword string

    SCAS Scan Byte or Word, Dword string

    LODS Load byte or Word, Dword string

    STOS Store byte or Word, Dword string

    REP Repeat

    REPE/REPZ Repeat while equal/zero

    RENE/REPNZ Repeat while not equal/not zero

    Table 2-2d. Logical Instructions


    NOT NOT operands

    AND AND operands

    OR Inclusive OR operands

    XOR Exclusive OR operands

    TEST Test operands



    Table 2-2d. Logical Instructions (Continued)


    SHL/SHR Shift logical left or right

    SAL/SAR Shift arithmetic left or right

    SHLD/SHRD Double shift left or right


    ROL/ROR Rotate left/right

    RCL/RCR Rotate through carry left/right

    Table 2-2e. Bit Manipulation Instructions


    BT Bit Test

    BTS Bit Test and Set

    BTR Bit Test and Reset

    BTC Bit Test and Complement

    BSF Bit Scan Forward

    BSR Bit Scan Reverse

    Table 2-2f. Program Control Instructions


    SETCC Set byte equal to condition code

    JA/JNBE Jump if above/not below nor equal

    JAE/JNB Jump if above or equal/not below

    JB/JNAE Jump if below/not above nor equal

    JBE/JNA Jump if below or equal/not above

    JC Jump if carry

    JE/JZ Jump if equal/zero

    JG/JNLE Jump if greater/not less nor equal

    JGE/JNL Jump if greater or equal/not less

    JL/JNGE Jump if less/not greater nor equal

    JLE/JNG Jump if less or equal/not greater

    JNC Jump if not carry

    JNE/JNZ Jump if not equal/not zero

    JNO Jump if not overflow

    JNP/JPO Jump if not parity/parity odd

    JNS Jump if not sign

    JO Jump if overflow

    JP/JPE Jump if parity/parity even

    JS Jump if Sign

    Table 2-2f. Program Control Instructions



    CALL Call procedure/task

    RET Return from procedure

    JMP Jump


    LOOP Loop

    LOOPE/LOOPZ Loop if equal/zero

    LOOPNE/LOOPNZ Loop if not equal/not zero

    JCXZ JUMP if register CXe0INTERRUPTS

    INT Interrupt

    INTO Interrupt if overflow

    IRET Return from Interrupt/Task

    CLI Clear interrupt Enable

    STI Set Interrupt Enable

    Table 2-2g. High Level Language Instructions

    BOUND Check Array Bounds

    ENTER Setup Parameter Block for EnteringProcedure

    LEAVE Leave Procedure

    Table 2-2h. Protection Model

    SGDT Store Global Descriptor Table

    SIDT Store Interrupt Descriptor Table

    STR Store Task Register

    SLDT Store Local Descriptor Table

    LGDT Load Global Descriptor Table

    LIDT Load Interrupt Descriptor Table

    LTR Load Task Register

    LLDT Load Local Descriptor Table

    ARPL Adjust Requested Privilege Level

    LAR Load Access Rights

    LSL Load Segment Limit

    VERR/VERW Verify Segment for Reading or Writing

    LMSW Load Machine Status Word (lower16 bits of CR0)

    SMSW Store Machine Status Word

    Table 2-2i. Processor Control Instructions

    HLT Halt

    WAIT Wait until BUSY negated

    ESC Escape

    LOCK Lock Bus




    2.5.1 Addressing Modes Overview

    The Intel386 DX provides a total of 11 addressingmodes for instructions to specify operands. The ad-dressing modes are optimized to allow the efficientexecution of high level languages such as C andFORTRAN, and they cover the vast majority of datareferences needed by high-level languages.

    2.5.2 Register and Immediate Modes

    Two of the addressing modes provide for instruc-tions that operate on register or immediate oper-ands:

    Register Operand Mode: The operand is locatedin one of the 8-, 16- or 32-bit general registers.

    Immediate Operand Mode: The operand is in-cluded in the instruction as part of the opcode.

    2.5.3 32-Bit Memory AddressingModes

    The remaining 9 modes provide a mechanism forspecifying the effective address of an operand. Thelinear address consists of two components: the seg-ment base address and an effective address. Theeffective address is calculated by using combina-tions of the following four address elements:

    DISPLACEMENT: An 8-, or 32-bit immediate value,following the instruction.

    BASE: The contents of any general purpose regis-ter. The base registers are generally used by compil-ers to point to the start of the local variable area.

    INDEX: The contents of any general purpose regis-ter except for ESP. The index registers are used toaccess the elements of an array, or a string of char-acters.

    SCALE: The index registers value can be multipliedby a scale factor, either 1, 2, 4 or 8. Scaled indexmode is especially useful for accessing arrays orstructures.

    Combinations of these 4 components make up the 9additional addressing modes. There is no perform-ance penalty for using any of these addressing com-binations, since the effective address calculation ispipelined with the execution of other instructions.

    The one exception is the simultaneous use of Baseand Index components which requires one addition-al clock.

    As shown in Figure 2-9, the effective address (EA) ofan operand is calculated according to the followingformula.

    EAeBase Rega(Index Reg * Scaling)aDisplacement

    Direct Mode: The operands offset is contained aspart of the instruction as an 8-, 16- or 32-bit dis-placement.EXAMPLE: INC Word PTR [500]

    Register Indirect Mode: A BASE register containsthe address of the operand.EXAMPLE: MOV [ECX], EDX

    Based Mode: A BASE registers contents is addedto a DISPLACEMENT to form the operands offset.EXAMPLE: MOV ECX, [EAXa24]

    Index Mode: An INDEX registers contents is addedto a DISPLACEMENT to form the operands offset.EXAMPLE: ADD EAX, TABLE[ESI]

    Scaled Index Mode: An INDEX registers contents ismultiplied by a scaling factor which is added to aDISPLACEMENT to form the operands offset.EXAMPLE: IMUL EBX, TABLE[ESI*4],7

    Based Index Mode: The contents of a BASE registeris added to the contents of an INDEX register toform the effective address of an operand.EXAMPLE: MOV EAX, [ESI] [EBX]

    Based Scaled Index Mode: The contents of an IN-DEX register is multiplied by a SCALING factor andthe result is added to the contents of a BASE regis-ter to obtain the operands offset.EXAMPLE: MOV ECX, [EDX*8] [EAX]

    Based Index Mode with Displacement: The contentsof an INDEX Register and a BASE registers con-tents and a DISPLACEMENT are all summed to-gether to form the operand offset.EXAMPLE: ADD EDX, [ESI] [EBPa00FFFFF0H]

    Based Scaled Index Mode with Displacement: Thecontents of an INDEX register are multiplied by aSCALING factor, the result is added to the contentsof a BASE register and a DISPLACEMENT to formthe operands offset.EXAMPLE: MOV EAX, LOCALTABLE[EDI*4][EBPa80]




    Figure 2-9. Addressing Mode Calculations

    2.5.4 Differences Between 16 and 32Bit Addresses

    In order to provide software compatibility with the80286 and the 8086, the Intel386 DX can execute16-bit instructions in Real and Protected Modes. Theprocessor determines the size of the instructions it isexecuting by examining the D bit in the CS segmentDescriptor. If the D bit is 0 then all operand lengthsand effective addresses are assumed to be 16 bitslong. If the D bit is 1 then the default length for oper-ands and addresses is 32 bits. In Real Mode thedefault size for operands and addresses is 16-bits.

    Regardless of the default precision of the operandsor addresses, the Intel386 DX is able to execute ei-ther 16 or 32-bit instructions. This is specified via theuse of override prefixes. Two prefixes, the OperandSize Prefix and the Address Length Prefix, over-ride the value of the D bit on an individual instructionbasis. These prefixes are automatically added by In-tel assemblers.

    Example: The processor is executing in Real Modeand the programmer needs to access the EAX regis-ters. The assembler code for this might be MOVEAX, 32-bit MEMORYOP, ASM386 Macro Assem-bler automatically determines that an Operand SizePrefix is needed and generates it.

    Example: The D bit is 0, and the programmer wishesto use Scaled Index addressing mode to access anarray. The Address Length Prefix allows the use ofMOV DX, TABLE[ESI*2]. The assembler uses anAddress Length Prefix since, with De0, the defaultaddressing mode is 16-bits.

    Example: The D bit is 1, and the program wants tostore a 16-bit quantity. The Operand Length Prefix isused to specify only a 16-bit value; MOV MEM16,DX.



    Table 2-3. BASE and INDEX Registers for 16- and 32-Bit Addresses

    16-Bit Addressing 32-Bit Addressing

    BASE REGISTER BX,BP Any 32-bit GP Register

    INDEX REGISTER SI,DI Any 32-bit GP Register

    Except ESP

    SCALE FACTOR none 1, 2, 4, 8

    DISPLACEMENT 0, 8, 16 bits 0, 8, 32 bits

    The OPERAND LENGTH and Address Length Pre-fixes can be applied separately or in combination toany instruction. The Address Length Prefix does notallow addresses over 64K bytes to be accessed inReal Mode. A memory address which exceedsFFFFH will result in a General Protection Fault. AnAddress Length Prefix only allows the use of the ad-ditional Intel386 DX addressing modes.

    When executing 32-bit code, the Intel386 DX useseither 8-, or 32-bit displacements, and any registercan be used as base or index registers. When exe-cuting 16-bit code, the displacements are either 8, or16 bits, and the base and index register conform tothe 80286 model. Table 2-3 illustrates the differenc-es.

    2.6 DATA TYPES

    The Intel386 DX supports all of the data types com-monly used in high level languages:

    Bit: A single bit quantity.

    Bit Field: A group of up to 32 contiguous bits,which spans a maximum of four bytes.

    Bit String: A set of contiguous bits, on the Intel386DX bit strings can be up to 4 gigabits long.

    Byte: A signed 8-bit quantity.

    Unsigned Byte: An unsigned 8-bit quantity.

    Integer (Word): A signed 16-bit quantity.

    Long Integer (Double Word): A signed 32-bit quan-tity. All operations assume a 2s complement rep-resentation.

    Unsigned Integer (Word): An unsigned 16-bitquantity.

    Unsigned Long Integer (Double Word): An un-signed 32-bit quantity.

    Signed Quad Word: A signed 64-bit quantity.

    Unsigned Quad Word: An unsigned 64-bit quanti-ty.

    Offset: A 16- or 32-bit offset only quantity whichindirectly references another memory location.

    Pointer: A full pointer which consists of a 16-bitsegment selector and either a 16- or 32-bit offset.

    Char: A byte representation of an ASCII Alphanu-meric or control character.

    String: A contiguous sequence of bytes, words ordwords. A string may contain between 1 byte and4 Gbytes.

    BCD: A byte (unpacked) representation of decimaldigits 09.

    Packed BCD: A byte (packed) representation oftwo decimal digits 09 storing one digit in eachnibble.

    When the Intel386 DX is coupled with an Intel387DX Numerics Coprocessor then the following com-mon Floating Point types are supported.

    Floating Point: A signed 32-, 64-, or 80-bit realnumber representation. Floating point numbersare supported by the Intel387 DX numerics co-processor.

    Figure 2-10 illustrates the data types supported bythe Intel386 DX and the Intel387 DX numerics co-processor.




    Figure 2-10. Intel386TM DX Supported Data Types




    2.7.1 Introduction

    Memory on the Intel386 DX is divided up into 8-bitquantities (bytes), 16-bit quantities (words), and32-bit quantities (dwords). Words are stored in twoconsecutive bytes in memory with the low-order byteat the lowest address, the high order byte at the highaddress. Dwords are stored in four consecutivebytes in memory with the low-order byte at the low-est address, the high-order byte at the highest ad-dress. The address of a word or dword is the byteaddress of the low-order byte.

    In addition to these basic data types, the Intel386DX supports two larger units of memory: pages andsegments. Memory can be divided up into one ormore variable length segments, which can beswapped to disk or shared between programs. Mem-ory can also be organized into one or more 4K bytepages. Finally, both segmentation and paging canbe combined, gaining the advantages of both sys-tems. The Intel386 DX supports both pages andsegments in order to provide maximum flexibility tothe system designer. Segmentation and paging arecomplementary. Segmentation is useful for organiz-ing memory in logical modules, and as such is a toolfor the application programmer, while pages are use-ful for the system programmer for managing thephysical memory of a system.

    2.7.2 Address Spaces

    The Intel386 DX has three distinct address spaces:logical, linear, and physical. A logical address

    (also known as a virtual address) consists of a se-lector and an offset. A selector is the contents of asegment register. An offset is formed by summing allof the addressing components (BASE, INDEX, DIS-PLACEMENT) discussed in section 2.5.3 MemoryAddressing Modes into an effective address. Sinceeach task on Intel386 DX has a maximum of 16K(214 b1) selectors, and offsets can be 4 gigabytes,(232 bits) this gives a total of 246 bits or 64 terabytesof logical address space per task. The programmersees this virtual address space.

    The segmentation unit translates the logical ad-dress space into a 32-bit linear address space. If thepaging unit is not enabled then the 32-bit linear ad-dress corresponds to the physical address. Thepaging unit translates the linear address space intothe physical address space. The physical addressis what appears on the address pins.

    The primary difference between Real Mode and Pro-tected Mode is how the segmentation unit performsthe translation of the logical address into the linearaddress. In Real Mode, the segmentation unit shiftsthe selector left four bits and adds the result to theoffset to form the linear address. While in ProtectedMode every selector has a linear base address as-sociated with it. The linear base address is stored inone of two operating system tables (i.e. the LocalDescriptor Table or Global Descriptor Table). Theselectors linear base address is added to the offsetto form the final linear address.

    Figure 2-11 shows the relationship between the vari-ous address spaces.


    Figure 2-11. Address Translation



    2.7.3 Segment Register Usage

    The main data structure used to organize memory isthe segment. On the Intel386 DX, segments are vari-able sized blocks of linear addresses which havecertain attributes associated with them. There aretwo main types of segments: code and data, thesegments are of variable size and can be as smallas 1 byte or as large as 4 gigabytes (232 bytes).

    In order to provide compact instruction encoding,and increase processor performance, instructionsdo not need to explicitly specify which segment reg-ister is used. A default segment register is automati-cally chosen according to the rules of Table 2-4(Segment Register Selection Rules). In general, datareferences use the selector contained in the DS reg-ister; Stack references use the SS register and In-struction fetches use the CS register. The contentsof the Instruction Pointer provides the offset. Specialsegment override prefixes allow the explicit use of agiven segment register, and override the implicitrules listed in Table 2-4. The override prefixes alsoallow the use of the ES, FS and GS segment regis-ters.

    There are no restrictions regarding the overlappingof the base addresses of any segments. Thus, all 6segments could have the base address set to zeroand create a system with a four gigabyte linear ad-dress space. This creates a system where the virtualaddress space is the same as the linear addressspace. Further details of segmentation are dis-cussed in section 4.1.

    2.8 I/O SPACE

    The Intel386 DX has two distinct physical addressspaces: Memory and I/O. Generally, peripherals areplaced in I/O space although the Intel386 DX alsosupports memory-mapped peripherals. The I/Ospace consists of 64K bytes, it can be divided into64K 8-bit ports, 32K 16-bit ports, or 16K 32-bit ports,or any combination of ports which add up to lessthan 64K bytes. The 64K I/O address space refersto physical memory rather than linear address sinceI/O instructions do not go through the segmentationor paging hardware. The M/IO pin acts as an addi-tional address line thus allowing the system designerto easily determine which address space the proces-sor is accessing.

    Table 2-4. Segment Register Selection Rules

    Type of Implied (Default) Segment Override

    Memory Reference Segment Use Prefixes Possible

    Code Fetch CS None

    Destination of PUSH, PUSHF, INT, SS NoneCALL, PUSHA Instructions

    Source of POP, POPA, POPF, SS NoneIRET, RET instructions

    Destination of STOS, MOVS, REP ES NoneSTOS, REP MOVS Instructions(DI is Base Register)

    Other Data References, withEffective Address Using BaseRegister of:




    The I/O ports are accessed via the IN and OUT I/Oinstructions, with the port address supplied as animmediate 8-bit constant in the instruction or in theDX register. All 8- and 16-bit port addresses are zeroextended on the upper address lines. The I/O in-structions cause the M/IO pin to be driven low.

    I/O port addresses 00F8H through 00FFH are re-served for use by Intel.


    2.9.1 Interrupts and Exceptions

    Interrupts and exceptions alter the normal programflow, in order to handle external events, to reporterrors or exceptional conditions. The difference be-tween interrupts and exceptions is that interrupts areused to handle asynchronous external events whileexceptions handle instruction faults. Although a pro-gram can generate a software interrupt via an INT Ninstruction, the processor treats software interruptsas exceptions.

    Hardware interrupts occur as the result of an exter-nal event and are classified into two types: maskableor non-maskable. Interrupts are serviced after theexecution of the current instruction. After the inter-rupt handler is finished servicing the interrupt, exe-cution proceeds with the instruction immediately af-ter the interrupted instruction. Sections 2.9.3 and2.9.4 discuss the differences between Maskable andNon-Maskable interrupts.

    Exceptions are classified as faults, traps, or abortsdepending on the way they are reported, and wheth-er or not restart of the instruction causing the excep-tion is supported. Faults are exceptions that are de-tected and serviced before the execution of thefaulting instruction. A fault would occur in a virtualmemory system, when the processor referenced apage or a segment which was not present. The oper-ating system would fetch the page or segment fromdisk, and then the Intel386 DX would restart the in-struction. Traps are exceptions that are reported im-mediately after the execution of the instructionwhich caused the problem. User defined interruptsare examples of traps. Aborts are exceptions whichdo not permit the precise location of the instructioncausing the exception to be determined. Aborts areused to report severe errors, such as a hardwareerror, or illegal values in system tables.

    Thus, when an interrupt service routine has beencompleted, execution proceeds from the instruction

    immediately following the interrupted instruction. Onthe other hand, the return address from an excep-tion fault routine will always point at the instructioncausing the exception and include any leading in-struction prefixes. Table 2-5 summarizes the possi-ble interrupts for the Intel386 DX and shows wherethe return address points.

    The Intel386 DX has the ability to handle up to 256different interrupts/exceptions. In order to servicethe interrupts, a table with up to 256 interrupt vec-tors must be defined. The interrupt vectors are sim-ply pointers to the appropriate interrupt service rou-tine. In Real Mode (see section 3.1), the vectors are4 byte quantities, a Code Segment plus a 16-bit off-set; in Protected Mode, the interrupt vectors are 8byte quantities, which are put in an Interrupt Descrip-tor Table (see section 4.1). Of the 256 possible inter-rupts, 32 are reserved for use by Intel, the remaining224 are free to be used by the system designer.

    2.9.2 Interrupt Processing

    When an interrupt occurs the following actions hap-pen. First, the current program address and theFlags are saved on the stack to allow resumption ofthe interrupted program. Next, an 8-bit vector is sup-plied to the Intel386 DX which identifies the appro-priate entry in the interrupt table. The table containsthe starting address of the interrupt service routine.Then, the user supplied interrupt service routine isexecuted. Finally, when an IRET instruction is exe-cuted the old processor state is restored and pro-gram execution resumes at the appropriate instruc-tion.

    The 8-bit interrupt vector is supplied to the Intel386DX in several different ways: exceptions supply theinterrupt vector internally; software INT instructionscontain or imply the vector; maskable hardware in-terrupts supply the 8-bit vector via the interrupt ac-knowledge bus sequence. Non-Maskable hardwareinterrupts are assigned to interrupt vector 2.

    2.9.3 Maskable Interrupt

    Maskable interrupts are the most common way usedby the Intel386 DX to respond to asynchronous ex-ternal hardware events. A hardware interrupt occurswhen the INTR is pulled high and the Interrupt Flagbit (IF) is enabled. The processor only responds tointerrupts between instructions, (REPeat String in-structions, have an interrupt window, betweenmemory moves, which allows interrupts during long



    Table 2-5. Interrupt Vector Assignments

    Instruction WhichReturn Address


    Can CausePoints to




    Divide Error 0 DIV, IDIV YES FAULT

    Debug Exception 1 any instruction YES TRAP*

    NMI Interrupt 2 INT 2 or NMI NO NMI

    One Byte Interrupt 3 INT NO TRAP

    Interrupt on Overflow 4 INTO NO TRAP

    Array Bounds Check 5 BOUND YES FAULT

    Invalid OP-Code 6 Any Illegal Instruction YES FAULT

    Device Not Available 7 ESC, WAIT YES FAULT

    Double Fault 8 Any Instruction That Can ABORTGenerate an Exception

    Coprocessor Segment Overrun 9 ESC NO ABORT


    Segment Not Present 11 Segment Register Instructions YES FAULT

    Stack Fault 12 Stack References YES FAULT

    General Protection Fault 13 Any Memory Reference YES FAULT

    Intel Reserved 15

    Page Fault 14 Any Memory Access or Code Fetch YES FAULT

    Coprocessor Error 16 ESC, WAIT YES FAULT

    Intel Reserved 1731

    Two Byte Interrupt 0255 INT n NO TRAP

    * Some debug exceptions may report both traps on the previous instruction, and faults on the next instruction.

    string moves). When an interrupt occurs the proces-sor reads an 8-bit vector supplied by the hardwarewhich identifies the source of the interrupt, (one of224 user defined interrupts). The exact nature of theinterrupt sequence is discussed in section 5.

    The IF bit in the EFLAG registers is reset when aninterrupt is being serviced. This effectively disablesservicing additional interrupts during an interruptservice routine. However, the IF may be set explicitlyby the interrupt handler, to allow the nesting of inter-rupts. When an IRET instruction is executed theoriginal state of the IF is restored.

    2.9.4 Non-Maskable Interrupt

    Non-maskable interrupts provide a method of servic-ing very high priority interrupts. A common exampleof the use of a non-maskable interrupt (NMI) wouldbe to activate a power failure routine. When the NMI

    input is pulled high it causes an interrupt with aninternally supplied vector value of 2. Unlike a normalhardware interrupt, no interrupt acknowledgment se-quence is performed for an NMI.

    While executing the NMI servicing procedure, the In-tel386 DX will not service further NMI requests, untilan interrupt return (IRET) instruction is executed orthe processor is reset. If NMI occurs while currentlyservicing an NMI, its presence will be saved for serv-icing after executing the first IRET instruction. The IFbit is cleared at the beginning of an NMI interrupt toinhibit further INTR interrupts.

    2.9.5 Software Interrupts

    A third type of interrupt/exception for the Intel386DX is the software interrupt. An INT n instructioncauses the processor to execute the interrupt serv-ice routine pointed to by the nth vector in the inter-rupt table.



    A special case of the two byte software interrupt INTn is the one byte INT 3, or breakpoint interrupt. Byinserting this one byte instruction in a program, theuser can set breakpoints in his program as a debug-ging tool.

    A final type of software interrupt, is the single stepinterrupt. It is discussed in section 2.12.

    2.9.6 Interrupt and ExceptionPriorities

    Interrupts are externally-generated events. Maska-ble Interrupts (on the INTR input) and Non-MaskableInterrupts (on the NMI input) are recognized at in-struction boundaries. When NMI and maskableINTR are both recognized at the same instructionboundary, the Intel386 DX invokes the NMI serviceroutine first. If, after the NMI service routine hasbeen invoked, maskable interrupts are still enabled,then the Intel386 DX will invoke the appropriate in-terrupt service routine.

    Table 2-6a. Intel386TM DX Priority for

    Invoking Service Routines in Case of

    Simultaneous External Interrupts

    1. NMI

    2. INTR

    Exceptions are internally-generated events. Excep-tions are detected by the Intel386 DX if, in thecourse of executing an instruction, the Intel386 DXdetects a problematic condition. The Intel386 DXthen immediately invokes the appropriate exceptionservice routine. The state of the Intel386 DX is suchthat the instruction causing the exception can be re-started. If the exception service routine has takencare of the problematic condition, the instruction willexecute without causing the same exception.

    It is possible for a single instruction to generate sev-eral exceptions (for example, transferring a singleoperand could generate two page faults if the oper-and location spans two not present pages). How-ever, only one exception is generated upon each at-tempt to execute the instruction. Each exceptionservice routine should correct its corresponding ex-ception, and restart the instruction. In this manner,exceptions are serviced until the instruction exe-cutes successfully.

    As the Intel386 DX executes instructions, it follows aconsistent cycle in checking for exceptions, asshown in Table 2-6b. This cycle is repeated

    as each instruction is executed, and occurs in paral-lel with instruction decoding and execution.

    Table 2-6b. Sequence of Exception Checking

    Consider the case of the Intel386 DX having justcompleted an instruction. It then performs thefollowing checks before reaching the point wherethe next instruction is completed:

    1. Check for Exception 1 Traps from the instruc-tion just completed (single-step via Trap Flag,or Data Breakpoints set in the Debug Regis-ters).

    2. Check for Exception 1 Faults in the next in-struction (Instruction Execution Breakpoint setin the Debug Registers for the next instruc-tion).

    3. Check for external NMI and INTR.

    4. Check for Segmentation Faults that preventedfetching the entire next instruction (exceptions11 or 13).

    5. Check for Page Faults that prevented fetchingthe entire next instruction (exception 14).

    6. Check for Faults decoding the next instruction(exception 6 if illegal opcode; exception 6 if inReal Mode or in Virtual 8086 Mode and at-tempting to execute an instruction for Protect-ed Mode only (see 4.6.4); or exception 13 ifinstruction is longer than 15 bytes, or privilegeviolation in Protected Mode (i.e. not at IOPL orat CPLe0).

    7. If WAIT opcode, check if TSe1 and MPe1(exception 7 if both are 1).

    8. If ESCAPE opcode for numeric coprocessor,check if EMe1 or TSe1 (exception 7 if eitherare 1).

    9. If WAIT opcode or ESCAPE opcode for nu-meric coprocessor, check ERROR input sig-nal (exception 16 if ERROR input is assert-ed).

    10. Check in the following order for each memo-ry reference required by the instruction:

    a. Check for Segmentation Faults that pre-vent transferring the entire memory quanti-ty (exceptions 11, 12, 13).

    b. Check for Page Faults that prevent trans-ferring the entire memory quantity (excep-tion 14).

    Note that the order stated supports the conceptof the paging mechanism being underneaththe segmentation mechanism. Therefore, for anygiven code or data reference in memory, seg-mentation exceptions are generated before pag-ing exceptions are generated.



    2.9.7 Instruction Restart

    The Intel386 DX fully supports restarting all instruc-tions after faults. If an exception is detected in theinstruction to be executed (exception categories 4through 10 in Table 2-6b), the Intel386 DX invokesthe appropriate exception service routine. The In-tel386 DX is in a state that permits restart of theinstruction, for all cases but those in Table 2-6c.Note that all such cases are easily avoided by prop-er design of the operating system.

    Table 2-6c. Conditions Preventing

    Instruction Restart

    A. An instruction causes a task switch to a taskwhose Task State Segment is partially notpresent. (An entirely not present TSS is re-startable.) Partially present TSSs can beavoided either by keeping the TSSs of suchtasks present in memory, or by aligning TSSsegments to reside entirely within a single 4Kpage (for TSS segments of 4K bytes or less).

    B. A coprocessor operand wraps around the topof a 64K-byte segment or a 4G-byte segment,and spans three pages, and the page holdingthe middle portion of the operand is not pres-ent. This condition can be avoided by startingat a page boundary any segments containingcoprocessor operands if the segments are ap-proximately 64K-200 bytes or larger (i.e. largeenough for wraparound of the coprocessoroperand to possibly occur).

    Note that these conditions are avoided by usingthe operating system designs mentioned in thistable.

    2.9.8 Double Fault

    A Double Fault (exception 8) results when the proc-essor attempts to invoke an exception service rou-tine for the segment exceptions (10, 11, 12 or 13),but in the process of doing so, detects an exceptionother than a Page Fault (exception 14).

    A Double Fault (exception 8) will also be generatedwhen the processor attempts to invoke the PageFault (exception 14) service routine, and detects anexception other than a second Page Fault. In anyfunctional system, the entire Page Fault service rou-tine must remain present in memory.

    Double page faults however do not raise the doublefault exception. If a second page fault occurs whilethe processor is attempting to enter the service rou-tine for the first time, then the processor will invoke

    the page fault (exception 14) handler a second time,rather than the double fault (exception 8) handler. Asubsequent fault, though, will lead to shutdown.

    When a Double Fault occurs, the Intel386 DX in-vokes the exception service routine for exception 8.


    When the processor is initialized or Reset the regis-ters have the values shown in Table 2-7. The In-tel386 DX will then start executing instructions nearthe top of physical memory, at location FFFFFFF0H.When the first InterSegment Jump or Call is execut-ed, address lines A20-31 will drop low for CS-rela-tive memory cycles, and the Intel386 DX will onlyexecute instructions in the lower one megabyte ofphysical memory. This allows the system designer touse a ROM at the top of physical memory to initializethe system and take care of Resets.

    RESET forces the Intel386 DX to terminate all exe-cution and local bus activity. No instruction execu-tion or bus activity will occur as long as Reset isactive. Between 350 and 450 CLK2 periods afterReset becomes inactive the Intel386 DX will startexecuting instructions at the top of physical memory.

    Table 2-7. Register Values after Reset

    Flag Word UUUU0002H Note 1

    Machine Status Word (CR0) UUUUUUU0H Note 2

    Instruction Pointer 0000FFF0H

    Code Segment F000H Note 3

    Data Segment 0000H

    Stack Segment 0000H

    Extra Segment (ES) 0000H

    Extra Segment (FS) 0000H

    Extra Segment (GS) 0000H

    DX register component and

    stepping ID Note 5

    All other registers undefined Note 4

    NOTES:1. EFLAG Register. The upper 14 bits of the EFLAGS reg-ister are undefined, VM (Bit 17) and RF (BIT) 16 are 0 asare all other defined flag bits.2. CR0: (Machine Status Word). All of the defined fields inthe CR0 are 0 (PG Bit 31, TS Bit 3, EM Bit 2, MP Bit 1, andPE Bit 0).3. The Code Segment Register (CS) will have its Base Ad-dress set to FFFF0000H and Limit set to 0FFFFH.4. All undefined bits are Intel Reserved and should not beused.5. DX register always holds component and stepping iden-tifier (see 5.7). EAX register holds self-test signature if self-test was requested (see 5.6).




    2.11.1 Self-Test

    The Intel386 DX has the capability to perform a self-test. The self-test checks the function of all of theControl ROM and most of the non-random logic ofthe part. Approximately one-half of the Intel386 DXcan be tested during self-test.

    Self-Test is initiated on the Intel386 DX when theRESET pin transitions from HIGH to LOW, and theBUSY pin is low. The self-test takes about 2**19clocks, or approximately 26 milliseconds with a20 MHz Intel386 DX. At the completion of self-testthe processor performs reset and begins normal op-eration. The part has successfully passed self-test ifthe contents of the EAX register are zero (0). If theresults of EAX are not zero then the self-test hasdetected a flaw in the part.

    2.11.2 TLB Testing

    The Intel386 DX provides a mechanism for testingthe Translation Lookaside Buffer (TLB) if desired.This particular mechanism is unique to the Intel386DX and may not be continued in the same way infuture processors. When testing the TLB pagingmust be turned off (PG e 0 in CR0) to enable theTLB testing hardware and avoid interference withthe test data being written to the TLB.

    There are two TLB testing operations: 1) write en-tries into the TLB, and, 2) perform TLB lookups. TwoTest Registers, shown in Figure 2-12, are providedfor the purpose of testing. TR6 is the test commandregister, and TR7 is the test data register. Thefields within these registers are defined below.

    C: This is the command bit. For a write into TR6 tocause an immediate write into the TLB entry, write a0 to this bit. For a write into TR6 to cause an immedi-ate TLB lookup, write a 1 to this bit.

    Linear Address: This is the tag field of the TLB. Ona TLB write, a TLB entry is allocated to this linearaddress and the rest of that TLB entry is set per thevalue of TR7 and the value just written into TR6. Ona TLB lookup, the TLB is interrogated per this valueand if one and only one TLB entry matches, the restof the fields of TR6 and TR7 are set from the match-ing TLB entry.

    Physical Address: This is the data field of the TLB.On a write to the TLB, the TLB entry allocated to thelinear address in TR6 is set to this value. On a TLBlookup, the data field (physical address) from theTLB is read out to here.

    PL: On a TLB write, PLe1 causes the REP field ofTR7 to select which of four associative blocks of theTLB is to be written, but PLe0 allows the internalpointer in the paging unit to select which TLB blockis written. On a TLB lookup, the PL bit indicateswhether the lookup was a hit (PL gets set to 1) or amiss (PL gets reset to 0).

    V: The valid bit for this TLB entry. All valid bits canalso be cleared by writing to CR3.

    D, D: The dirty bit for/from the TLB entry.

    U, U: The user bit for/from the TLB entry.

    W, W: The writable bit for/from the TLB entry.

    For D, U and W, both the attribute and its comple-ment are provided as tag bits, to permit the option ofa dont care on TLB lookups. The meaning ofthese pairs of bits is given in the following table:

    X XEffect During Value of Bit

    TLB Lookup X after TLB Write

    0 0 Miss All Bit X Becomes Undefined

    0 1 Match if X e 0 Bit X Becomes 01 0 Match if X e 1 Bit X Becomes 11 1 Match all Bit X Becomes Undefined

    For writing a TLB entry:

    1. Write TR7 for the desired physical address, PLand REP values.

    2. Write TR6 with the appropriate linear address,etc. (be sure to write C e 0 for write com-mand).

    For looking up (reading) a TLB entry:

    1. Write TR6 with the appropriate linear address (besure to write Ce1 for lookup command).

    2. Read TR7 and TR6. If the PL bit in TR7 indicatesa hit, then the other values reveal the TLB con-tents. If PL indicates a miss, then the other valuesin TR7 and TR6 are indeterminate.


    The Intel386 DX provides several features whichsimplify the debugging process. The three catego-ries of on-chip debugging aids are:

    1) the code execution breakpoint opcode (0CCH),

    2) the single-step capability provided by the TF bit inthe flag register, and

    3) the code and data breakpoint capability providedby the Debug Registers DR0-3, DR6, and DR7.



    31 12 11 0


    0 0 0 0 C TR6

    PHYSICAL ADDRESS 0 0 0 0 0 0 0P

    REP 0 0 TR7L

    NOTE: 0 indicates Intel reserved: Do not define; SEE SECTION 2.3.10

    Figure 2-12. Test Registers

    2.12.1 Breakpoint Instruction

    A single-byte-opcode breakpoint instruction is avail-able for use by software debuggers. The breakpointopcode is 0CCh, and generates an exception 3 trapwhen executed. In typical use, a debugger programcan plant the breakpoint instruction at all desiredcode execution breakpoints. The single-byte break-point opcode is an alias for the two-byte generalsoftware interrupt instruction, INT n, where ne3.The only difference between INT 3 (0CCh) and INT nis that INT 3 is never IOPL-sensitive but INT n isIOPL-sensitive in Protected Mode and Virtual 8086Mode.

    2.12.2 Single-Step Trap

    If the single-step flag (TF, bit 8) in the EFLAG regis-ter is found to be set at the end of an instruction, asingle-step exception occurs. The single-step ex-ception is auto vectored to exception number 1. Pre-cisely, exception 1 occurs as a trap after the instruc-tion following the instruction which set TF. In typicalpractice, a debugger sets the TF bit of a flag registerimage on the debuggers stack. It then typicallytransfers control to the user program and loads theflag image with a signal instruction, the IRET instruc-tion. The single-step trap occurs after executing oneinstruction of the user program.

    Since the exception 1 occurs as a trap (that is, itoccurs after the instruction has already executed),the CS:EIP pushed onto the debuggers stack pointsto the next unexecuted instruction of the programbeing debugged. An exception 1 handler, merely byending with an IRET instruction, can therefore effi-ciently support single-stepping through a user pro-gram.

    2.12.3 Debug Registers

    The Debug Registers are an advanced debuggingfeature of the Intel386 DX. They allow data accessbreakpoints as well as code execution breakpoints.Since the breakpoints are indicated by on-chip regis-ters, an instruction execution breakpoint can be

    placed in ROM code or in code shared by severaltasks, neither of which can be supported by the INT3breakpoint opcode.

    The Intel386 DX contains six Debug Registers, pro-viding the ability to specify up to four distinct break-points addresses, breakpoint control options, andread breakpoint status. Initially after reset, break-points are in the disabled state. Therefore, no break-points will occur unless the debug registers are pro-grammed. Breakpoints set up in the Debug Regis-ters are autovectored to exception number 1. LINEAR ADDRESS BREAKPOINTREGISTERS (DR0DR3)

    Up to four breakpoint addresses can be specified bywriting into Debug Registers DR0DR3, shown inFigure 2-13. The breakpoint addresses specified are32-bit linear addresses. Intel386 DX hardware con-tinuously compares the linear breakpoint addressesin DR0DR3 with the linear addresses generated byexecuting software (a linear address is the result ofcomputing the effective address and adding the32-bit segment base address). Note that if paging isnot enabled the linear address equals the physicaladdress. If paging is enabled, the linear address istranslated to a physical 32-bit address by the on-chip paging unit. Regardless of whether paging isenabled or not, however, the breakpoint registershold linear addresses. DEBUG CONTROL REGISTER (DR7)

    A Debug Control Register, DR7 shown in Figure2-13, allows several debug control functions such asenabling the breakpoints and setting up other con-trol options for the breakpoints. The fields within theDebug Control Register, DR7, are as follows:

    LENi (breakpoint length specification bits)

    A 2-bit LEN field exists for each of the four break-points. LEN specifies the length of the associatedbreakpoint field. The choices for data breakpointsare: 1 byte, 2 bytes, and 4 bytes. Instruction execu-



    31 16 15 0





    Intel reserved. Do not define. DR4

    Intel reserved. Do not define. DR5

    0B B B

    0 0 0 0 0 0 0 0 0B B B B

    DR6T S D 3 2 1 0


    G0 0 0

    G L G L G L G L G LDR7

    3 3 3 2 2 2 1 1 1 0 0 0 D E E 3 3 2 2 1 1 0 0

    31 16 15 0

    NOTE: 0 indicates Intel reserved: Do not define; SEE SECTION 2.3.10

    Figure 2-13. Debug Registers

    tion breakpoints must have a length of 1 (LENi e00). Encoding of the LENi field is as follows:

    Usage of LeastLENi Breakpoint Significant Bits in

    Encoding Field Width Breakpoint AddressRegister i, (ie0b3)

    00 1 byte All 32-bits used tospecify a single-bytebreakpoint field.

    01 2 bytes A1A31 used tospecify a two-byte,word-alignedbreakpoint field. A0 inBreakpoint AddressRegister is not used.

    10 Undefineddo not use

    this encoding

    11 4 bytes A2A31 used tospecify a four-byte,dword-alignedbreakpoint field. A0and A1 in BreakpointAddress Register arenot used.

    The LENi field controls the size of breakpoint field iby controlling whether all low-order linear addressbits in the breakpoint address register are used todetect the breakpoint event. Therefore, all break-point fields are aligned; 2-byte breakpoint fields be-gin on Word boundaries, and 4-byte breakpointfields begin on Dword boundaries.

    The following is an example of various size break-point fields. Assume the breakpoint linear address inDR2 is 00000005H. In that situation, the followingillustration indicates the region of the breakpointfield for lengths of 1, 2, or 4 bytes.

    DR2e00000005H; LEN2 e 00B31 0


    bkpt fld2 00000004H


    DR2e00000005H; LEN2 e 01B31 0


    w bkpt fld2 x 00000004H00000000H

    DR2e00000005H; LEN2 e 11B31 0


    w bkpt fld2 x 00000004H00000000H



    RWi (memory access qualifier bits)

    A 2-bit RW field exists for each of the four break-points. The 2-bit RW field specifies the type of usagewhich must occur in order to activate the associatedbreakpoint.

    RW Usage

    Encoding Causing Breakpoint

    00 Instruction execution only

    01 Data writes only

    10 Undefineddo not use this encoding

    11 Data reads and writes only

    RW encoding 00 is used to set up an instructionexecution breakpoint. RW encodings 01 or 11 areused to set up write-only or read/write data break-points.

    Note that instruction execution breakpoints aretaken as faults (i.e. before the instruction exe-cutes), but data breakpoints are taken as traps(i.e. after the data transfer takes place).

    Using LENi and RWi to Set Data Breakpoint i

    A data breakpoint can be set up by writing the linearaddress into DRi (i e 03). For data breakpoints,RWi can e 01 (write-only) or 11 (write/read). LENcan e 00, 01, or 11.

    If a data access entirely or partly falls within the databreakpoint field, the data breakpoint condition hasoccurred, and if the breakpoint is enabled, an excep-tion 1 trap will occur.

    Using LENi and RWi to Set Instruction ExecutionBreakpoint i

    An instruction execution breakpoint can be set up bywriting address of the beginning of the instruction(including prefixes if any) into DRi (i e 03). RWimust e 00 and LEN must e 00 for instruction exe-cution breakpoints.

    If the instruction beginning at the breakpoint addressis about to be executed, the instruction executionbreakpoint condition has occurred, and if the break-point is enabled, an exception 1 fault will occur be-fore the instruction is executed.

    Note that an instruction execution breakpoint ad-dress must be equal to the beginning byte addressof an instruction (including prefixes) in order for theinstruction execution breakpoint to occur.

    GD (Global Debug Register access detect)

    The Debug Registers can only be accessed in RealMode or at privilege level 0 in Protected Mode. The

    GD bit, when set, provides extra protection againstany Debug Register access even in Real Mode or atprivilege level 0 in Protected Mode. This additionalprotection feature is provided to guarantee that asoftware debugger (or ICETM-386) can have full con-trol over the Debug Register resources when re-quired. The GD bit, when set, causes an exception 1fault if an instruction attempts to read or write anyDebug Register. The GD bit is then automaticallycleared when the exception 1 handler is invoked,allowing the exception 1 handler free access to thedebug registers.

    GE and LE (Exact data breakpoint match, global andlocal)

    If either GE or LE is set, any data breakpoint trap willbe reported exactly after completion of the instruc-tion that caused the operand transfer. Exact report-ing is provided by forcing the Intel386 DX executionunit to wait for completion of data operand transfersbefore beginning execution of the next instruction.

    If exact data breakpoint match is not selected, databreakpoints may not be reported until several in-structions later or may not be reported at all. Whenenabling a data breakpoint, it is therefore recom-mended to enable the exact data breakpoint match.

    When the Intel386 DX performs a task switch, theLE bit is cleared. Thus, the LE bit supports fast taskswitching out of tasks, that have enabled the exactdata breakpoint match for their task-local break-points. The LE bit is cleared by the processor duringa task switch, to avoid having exact data breakpointmatch enabled in the new task. Note that exact databreakpoint match must be re-enabled under soft-ware control.

    The Intel386 DX GE bit is unaffected during a taskswitch. The GE bit supports exact data breakpointmatch that is to remain enabled during all tasks exe-cuting in the system.

    Note that instruction execution breakpoints are al-ways reported exactly, whether or not exact databreakpoint match is selected.

    Gi and Li (breakpoint enable, global and local)

    If either Gi or Li is set then the associated breakpoint(as defined by the linear address in DRi, the lengthin LENi and the usage criteria in RWi) is enabled. Ifeither Gi or Li is set, and the Intel386 DX detects theith breakpoint condition, then the exception 1 han-dler is invoked.

    When the Intel386 DX performs a task switch to anew Task State Segment (TSS), all Li bits arecleared. Thus, the Li bits support fast task switchingout of tasks that use some task-loca